Data Blackouts and AI Fair Dealing: The Supreme Court and Delhi HC Rewrite India's Tech Law Landscape in 2026

The theoretical debates surrounding India’s technology and data regime are officially over. As we navigate the latter half of 2026, the friction between the Digital Personal Data Protection (DPDP) Act, 2023 and legacy legislations has spilled out of parliament and firmly into the constitutional courts. For practicing lawyers, two massive developments—one at the Supreme Court on the Right to Information (RTI), and another at the Delhi High Court on Generative AI—demand immediate attention.

The RTI-DPDP Collision: Supreme Court Allows the Information Blackout (For Now)

The most consequential constitutional development of the year is the Supreme Court’s decision to refer the challenges against the DPDP Act’s amendment of the RTI Act to a five-judge Constitution Bench. Crucially, the Court declined to stay the amendment while the reference is pending.

To understand why this is a seismic shift for administrative and constitutional lawyers, we must look at the mechanics of the amendment. Section 44(3) of the DPDP Act amended Section 8(1)(j) of the Right to Information Act, 2005. Previously, Section 8(1)(j) allowed Public Information Officers (PIOs) to withhold personal information unless there was a larger public interest justifying its disclosure. The DPDP Act entirely deleted this public interest caveat, creating a blanket exemption for anything classified as "personal information."

"By refusing to stay the amendment, the Supreme Court has practically sanctioned a dark age for transparency. Government departments are already weaponizing the amended Section 8(1)(j) to reject routine RTI applications, citing privacy."

Adding fuel to this fire is the fresh PIL, Mazdoor Kisan Shakti Sangathan and Ors. v. Union of India (W.P.(C) No. 358/2026). The petitioners are seeking interim relief against the mass masking and deletion of previously public data (like NREGA muster rolls and panchayat beneficiary lists) from government portals.

Practice Impact: If you are representing journalists, civil society groups, or even commercial entities relying on public government data, your litigation strategy must pivot. You can no longer rely on the standard "public interest" argument before the Central Information Commission (CIC). Until the Constitution Bench rules, lawyers will need to creatively argue that the requested data does not meet the strict definitional threshold of "personal data" under Section 2(t) of the DPDP Act, rather than arguing for a public interest override.

Generative AI Gets a Controversial "Fair Dealing" Shield

While the Supreme Court grapples with data privacy, the Delhi High Court has thrown a massive curveball into intellectual property jurisprudence. In the highly watched dispute between ANI and OpenAI, the Court held prima facie that OpenAI’s storage and use of ANI’s copyrighted works for training its Large Language Models (LLMs) falls within the safe harbor of Section 52(1)(a) of the Copyright Act, 1957.

This is a staggering interpretation of the law. Section 52(1)(a) protects "fair dealing" with any work for the purposes of private or personal use, including research. Historically, Indian courts have interpreted this exception narrowly. By squeezing the commercial scraping of copyrighted news content by a multi-billion-dollar AI enterprise into the "research" or "fair dealing" exception, the Delhi High Court has taken a distinctly pro-innovation, anti-monopoly stance.

Practice Impact: IP litigators and TMT (Technology, Media, and Telecom) practitioners must urgently re-evaluate their clients' licensing strategies. If you represent publishers or media houses, sending a standard cease-and-desist notice for copyright infringement (Section 51) to AI companies just lost its teeth. You must now prepare to argue why commercial LLM training fails the traditional four-factor fair dealing test, specifically focusing on market substitution. Conversely, lawyers advising AI startups now have a potent prima facie precedent to defend against web-scraping claims.

The DPDP Compliance Clock: May 2027 is the Finish Line

Beyond the courtroom, the regulatory clock is ticking loudly for corporate commercial teams. Following the notification of the DPDP Rules in November 2025 (which digested a staggering 6,900 stakeholder comments), the implementation timeline is now concrete.

The Consent Manager framework will go live by mid-November 2026. However, the real deadline for enterprise compliance—encompassing breach reporting, verifiable parental consent for children’s data, and the onerous obligations for Significant Data Fiduciaries (SDFs)—is set for May 13, 2027.

The Supreme Court has already signaled how strictly it will view these obligations. In a recent directive regarding the APAAR (Automated Permanent Academic Account Registry) student ID system, the Court mandated that schools must provide an explicit opt-out option for parents, explicitly tethering educational data collection to DPDP Act compliance.

Practice Impact: The time for "wait and see" is over. Corporate lawyers must immediately audit and redraft Data Processing Agreements (DPAs). Even though the cross-border transfer rules are still structurally ambiguous in practice, enterprises cannot wait until May 2027 to implement technical privacy-by-design architectures. If your client handles children's data (EdTech, gaming), the APAAR ruling is your blueprint: default opt-ins are legally dead. Consent must be granular, verifiable, and easily revocable.

2026 is proving to be the crucible where India's digital ambitions are finally being tested against the rigid realities of constitutional rights and legacy IP frameworks. For the Indian practitioner, staying ahead means understanding not just what the law says, but how these statutory collisions are being resolved in real-time.